Trust · Subprocessors
Every third party that may handle customer data.
This list is updated before a new subprocessor touches customer data, and customers are notified under the Data Processing Agreement.
Active list
Current subprocessor inventory
| Subprocessor | Purpose | Data location | Added or last changed |
|---|---|---|---|
| IONOS SE | Production hosting: API, database and screening engine | United Kingdom | 22/08/2026 |
| Cloudflare, Inc. | DNS, edge CDN, DDoS mitigation, WAF and bot challenge (Turnstile) on public forms | Global edge network | 22/08/2026 |
| 20i Ltd | Transactional and campaign email delivery | United Kingdom | 22/08/2026 |
| Revolut Ltd | Card payment processing for self-serve plans | United Kingdom, EU | 22/08/2026 |
| Google LLC | Adverse-media screening: the name being screened is sent to Google Programmable Search as a search query. Also social sign-in when a user chooses Google login, and website analytics once analytics cookies are accepted | US, EU | 23/10/2026 |
| LinkedIn Corporation | Social sign-in, only when a user chooses LinkedIn login | US, EU | 22/08/2026 |
Notice of changes. We notify you at least 30 days before we engage a new subprocessor or replace an existing one: by email to your account’s administrator contact, and by updating this list with the date of the change. You can object within that period on reasonable data protection grounds, and if we cannot accommodate your objection you can terminate the affected services. The full terms are in the Data Processing Agreement.
Last change to this list: 23/10/2026. Email dpo@on8.ai for the full DPA-attached version.